Re: membership request to the closed linux-distros security mailing list

[Daniel Micay <danielmicay () gmail com>]

On 20/03/15 12:05 PM, Anthony Liguori wrote:
> Upstreams are already free to do this, no?  If an upstream reporter
> sends to distros@ or another forum, they have already made that
> risk/reward trade-off.

I would expect that people are reporting vulnerabilities to the list
because they see it as the most responsible form of disclosure. I don't
think they're in the position to make an accurate risk/reward trade-off
though. There's little information on how the distributions are making
use of this information. I don't think many people would be reporting
bugs to it if they knew the answer to that question...

The distros subscribed to the list are in the position to state whether
it's helping them minimize the delay between disclosure and shipping a
patch or whether it's simply tying their hands for more time. I'm sure
it's a mix of both, but I'd like to hear from them.

For most vulnerabilities, I doubt that having early notice is at all
helpful. The important factor is that there's a working patch out of the
gate from upstream and ideally new point releases for any of the
supported versions.

It's just a artificial delay before shipping a patch can happen. IMO,
only distributions with ancient versions where the patches don't apply
cleanly are going to benefit. There's also the possibility of related
issues, but upstream and the discover of the issues are in the best
position to find those.

Attachment: signature.asc
Description: OpenPGP digital signature